SQL Injections Hitting Thousands of Sites

[Tami]

SQL Injections Hitting Thousands of Sites
By David Utter

The dynamic capabilities of websites powered by back-end databases made thousands of them targets for injections of unsanitized code.

A trio of domains have been found to host malicious exploits that people may hit while searching the Internet. Links to this content turned up in thousands of links to otherwise innocent websites, thanks to a seemingly unstoppable outbreak of SQL injection attacks.

Security vendor [url=\"http://www.f-secure.com/weblog/archives/00001427.html\"]F-Secure[/url] discovered in a cursory search on Google the presence of 510,000 pages affected by the attacks on a variety of sites. F-Secure advised security pros to block access to the rogue domains hosting the malware: nmidahena.com, aspder.com and nihaorr1.com.

The bad people want to drop a gaming trojan onto a victim's system. With ten million players alone on World of Warcraft, and thousands more on other online games, such trojans could grab login credentials and steal billing information or in-game valuables.

"Unless that data is sanitized before it gets saved you can't control what the website will show to the users. This is what SQL injection is all about, exploiting weaknesses in these controls," F-Secure said.

The security vendor found the attack at issue now seeks out all of the text fields in the database, and adds a link to malicious JavaScript to them. ASP-based websites take note: the attackers look for .asp and .aspx pages.

Any site offering the ability to upload content, from blogs to forums and beyond, could be at risk from the attack. F-Secure suggested webmasters check their server logs for a section of the injection code they listed in this latest post about the attacks. If it's present, the database needs to be cleaned up, and the application fixed to sanitize incoming content.

About the Author:
David Utter is a business and technology writer for [url=\"http://www.securitypronews.com/\"]SecurityProNews[/url] and [url=\"http://www.webpronews.com/\"]WebProNews[/url].